User manual

Global Configuration Commands
5-11
access-list
[<100-199>|<2000-
2699>] [permit|deny]
[icmp|ip|tcp|udp]
[<IP/MASK>|any|
host <IP>] {[rule-
precedence <1-5000>
{log}|log]}
Adds an Extended IP access list entry.
• (<100-199>|<2000-2699>) – For ICMP extended ACLs, the
ACL must be between 2000-2699
• [deny|permit] – Defines action types on an ACL.
• [icmp|ip|tcp|udp] – The protocol type for the extended
ACL entry.
• [<IP/MASK>| host <IP>| any] – <IP/MASK> is the
source address of the network or host in dotted
decimal format. For example, 10.1.1.10/24
indicates the first 24 bits of the source IP are used
for matching.
• The keyword any is an abbreviation for a source IP
of 0.0.0.0 and source-mask bits equal to 0
• The keyword host is an abbreviation for exact
source (A.B.C.D) and source-mask bits equal to 32
• log – Generates log messages when the packet
coming from the interface matches the ACL entry.
Log messages are generated only for router ACL’s.
This is an optional parameter
• rule-precedence <1-5000> – Define an Integer
value between 1-5000. This value sets the rule
precedence in the ACL. This is an optional
parameter.